* Generating a Private Key and CSR

We assume you have openssl module/package installed on your system or server .
The openssl toolkit is used to generate an RSA Private Key and CSR (Certificate Signing Request). It can also be used to generate self-signed certificates which can be used for testing purposes or internal usage. The utility used to do all of these tasks is known simply as openssl. It should be installed in the /usr/local/ssl/bin directory. You may want to add this directory to your PATH, or copy or link the openssl utility to a directory that is already in your PATH so that you do not have to type the full path to the executable. The examples below will assume that openssl is in a location that is accessible to you without using the full path to the command.

The first step is to create your RSA Private Key. This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text. We will use several files as random seed enhancers which will help to make the key more secure. Text files that have been compressed with a utility such as gzip are good choices. The key is generated using the following command, where file1:file2:etc represents the random compressed files.

The command will prompt you for a pass-phrase and then store the key in the file server.key. It is critical that the pass-phrase be secure and not forgotten. If either the key is lost, or the pass-phrase is forgotten, the certificate will be useless! It cannot be stressed enough how important the private key is to the certificate. If the private key and pass-phrase are compromised, the certificate will have to be revoked, costing you the price of the certificate all over again if you have paid an authority for the certificate. It may be a wise idea to back this file up to secure media, such as tape or diskette.

One unfortunate side-effect of the pass-phrased private key is that Apache will ask for the pass-phrase each time the web server is started. Obviously this is not necessarily convenient as someone will not always be around to type in the pass-phrase, such as after a reboot or crash. mod_ssl includes the ability to use an external program in place of the built-in pass-phrase dialog, however, this is not necessarily the most secure option either. It is possible to remove the Triple-DES encryption from the key, thereby no longer needing to type in a pass-phrase. If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked. With that being said, use the following command to remove the pass-phrase from the key:

$ openssl rsa -in server.key -out server.pem

Once the private key is generated a Certificate Signing Request can be generated. The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate. The second option is to self-sign the CSR, which will be demonstrated in the next section.

During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for “Common Name (e.g., YOUR name)“. It is important that this field be filled in with the fully qualified domain name of the server to be protected by SSL. If the website to be protected will be https://www.server.com, then enter www.server.com at this prompt. The command to generate the CSR is as follows:

Please enter the following ‘extra’ attributes to be sent with your certificate request
A challenge password []:
An optional company name []:

Generating a Self-Signed Certificate

At this point you will need to generate a self-signed certificate because you either don’t plan on having your certificate signed by a CA, or you wish to test your new SSL implementation while the CA is signing your certificate. In my experience dealing with Thawte, it can take up to a week or more before receiving your signed certificate. The time it takes to receive the certificate will vary based on how quickly they receive your required documentation. This temporary certificate will generate an error in the client browser to the effect that the signing certificate authority is unknown and not trusted.

To generate a temporary certificate which is good for 60 days, issue the following command:

Try following these steps incase if you do not want to ssl certificate with passphrase, since it ask everytime you restart your apache service. Ensure that you have correct certificate name with your apache config.

$openssl rsa -in server.key -out server.key.nopass

Installing the Private Key and Certificate

When Apache with mod_ssl is installed, it creates several directories in the Apache config directory. The location of this directory will differ depending on how Apache was compiled. If using my instructions on compiling Apache, the config directory is /usr/local/apache/etc. The directories mod_ssl creates include ssl.crt, ssl.csr, and ssl.key. These are good locations to store server certificates, CSRs, and private keys, respectively. If there will be multiple SSL enabled hosts on one server, it may be good practice to name the files with the fully qualified domain name of the SSL enabled host.

When adding SSL enabled virtualhosts to the web server, I prefer to keep all of the SSL virtualhosts in a separate file. This insures that all SSL hosts can be easily found in one location and helps to keep the httpd.conf file from growing too large. The SSL virtualhosts will be kept in a file called ssl.conf. In order for Apache to recognize and parse this file, it must be included in the httpd.conf file with the following directive:

Include /usr/local/apache/etc/ssl.conf

Configuring SSL Enabled Virtual Hosts

Extensive examples of SSL configurations for a virtualhost are included as part of the /usr/local/apache/etc/httpd.conf.default file installed with mod_ssl. Please refer to this file and to the mod_ssl documentation for more detailed information on configuration options. A basic SSL enabled virtualhost will appear as follows in the ssl.conf file:

This will create an SSL virtualhost named www.domain.com, which is accessed via port 443 (the standard port for https) on the default IP address of the web server. It is possible to add as many additional virtualhosts as there are IP addresses that the web server listens to. Simply add additional virtualhost blocks inside of the and tags. Due to the nature of the SSL encryption of the HTTP traffic, it is NOT possible to have name-based (HTTP1.1) SSL virtual hosts. To create a new SSL virtualhost on a different IP address, simply replace _default_ with the IP address of the virtualhost.

Apache Tomcat and Apache HTTP web server integration –

1. I would advice to use Apache http web server module “mod_jk” instead of “mod_proxy” because of following reasons –

It has greater control to manage the request/response internally between Apache’s http and tomcat server.

This will enable to have internal software load balancing with greater control options, if required.

It is more secure then mod_proxy.

Detailed log mechanism to figure out any communication errors.

Greater control over option what you want to server from which server internally (ie. static content from http server and java content from tomcat)

Support for large AJP packet sizes (“mod_proxy_ajp” does not support large 8K+ packet sizes).

Advanced node failure detection (if load balancer mechanism used).

* Only biggest advantage of using mod_proxy* module is easy and short configuration in Apache conf file to achieve integration.

2. SSL certificate should be installed on Apache’s http server instead of tomcat. 3. Tomcat should be running on separate port other than standard http and https port. 4. Apache’s http webserver should be running on standard http and https ports. It is easy feasible to secure Apache’s http server instead of tomcat server, since tomcat is not a full featured web server.

REMOTE_FTP_SERVER=192.168.0.1 # Server where to put the Incremental Load files
REMOTE_FTP_USER=ftpuser # User to login at REMOTE_FTP_USER
REMOTE_FTP_PASSWORD=ftppassword #Passwd for FTP usr at REMOTE_FTP_USR
REMOTE_FTP_DIR=/opt/remoteftparea # Directory where to put the files
SOURCE_DIR=/opt/localftparea # Directory from where file is FTP’d

TIMESTAMP=`date +%d%m%Y`
LOGFILE=/opt/FTP_$TIMESTAMP.log # Log file

log() { echo “`date +%H:%M` – $1” >> $LOGFILE; }

Save below script as Ftpscript.sh

#!/bin/sh
################################################################
# File: Ftpscript.sh
# Description: Trasfer file if they are changed and are more than 0 byte onto remote area # using FTP protocol task by itquery
################################################################
. `dirname $0`/Ftpenv.sh